AI agents that do real work — behind real controls.
Most agent projects fail in one of two directions: the agent is so restricted it does nothing useful, or so trusted it becomes a liability with your credentials. The way out is infrastructure — work queues, credential mediation, audit trails, and approval gates that stay human. We build that layer for teams that want agents doing real work, because we run one ourselves.
Agents act. Humans approve.
The common framing has it backwards: a human doing the work with an AI making suggestions. In a working agent system, the agents do the work — drafting, building, processing, following up — and the humans hold the gates: what gets attempted, what ships, and what the agents may touch at all. That inversion is what makes agents worth running, and it only holds if the gates are enforced by the system rather than promised by a prompt.
A prompt is advisory. An agent that has your database password does not become safe because its instructions say “be careful.” The controls that survive contact with a confused model live outside the model: repository access that is mediated rather than raw, credentials that are scoped and short-lived rather than pasted into a config, and actions that leave a log someone can actually read.
The layer between the model and your business
The models are rented. The infrastructure around them is the part you have to get right.
- Agentic workflows. Agents wired into your real work intake — a queue that is the system of record, scoped tasks, and handoffs that survive an agent dying mid-job.
- Credential mediation. Agents never hold your keys. Each holds a scoped token and asks a control plane for what it needs; what it gets back is short-lived, job-scoped, and revocable. Blast radius is set by what an agent holds, not what it was told.
- Human approval gates. Scope sign-off, ship sign-off, and access grants stay human, permanently — enforced in the system, not requested in the prompt.
- Audit trails. Every claim, action, and access grant leaves a record a human can review after the fact. When something goes sideways, you get a timeline instead of a mystery.
- LLM integration done plainly. Anthropic Claude, OpenAI, or local models where privacy or cost demands it — treated as components with measured failure modes, not as magic.
We run our own fleet
This is not an architecture we read about. Date Palm Media’s own delivery runs on a production fleet of AI coding agents, working every day behind exactly these controls: mediated git transport, scoped credentials, human review on everything that ships. Our founder built the fleet and writes about operating it in Running a fleet of AI coding agents in production; the discipline described there is the discipline we install for clients.
Parts of that tooling are becoming products in their own right — including RepoHarbor, a git control plane for agent-running teams, open source (Apache-2.0 core) and nearing general availability. Client engagements don’t depend on our products: we build on your stack, in your accounts, and you own the result.
The AI lineage is longer than the current wave. We shipped AI in production in 2018 — Speak Meetings, built from custom NLP pipelines on live call traffic before large language models were a commodity. The habits that come from that era — evaluate before trusting, treat failure as a distribution, keep the human gates — are the same ones agent infrastructure needs now.
Straight answers
Are prompts enough to keep an agent safe?
No. A prompt is advice, and an agent under pressure — a confusing error, a poisoned input, plain model drift — can route around advice. The controls that hold are the ones enforced outside the model: mediated repository access, credentials the agent never holds, approval gates a human has to click. We design for the day the prompt fails, because that day comes.
Do we need all of this just to try AI agents?
No. An experiment needs a sandbox and a spending cap. Infrastructure matters at the point where agents touch things that are expensive to un-touch: your repositories, your customer data, your production systems, your credentials. If you are at that point — or you got there by accident and it scared you — that is exactly the situation this engagement exists for.
What do you actually deliver?
A working system, not a slide deck: agentic workflows wired into your real work intake, credential mediation so agents hold scoped short-lived tokens instead of your keys, audit trails a human can read after the fact, and the approval gates that keep scope, shipping, and access decisions human. The shape depends on your operation, which is why the first step is a fixed-scope assessment.
What does it cost?
The first step is the Production Blueprint: a fixed-scope assessment starting at $2,500, most falling between $2,500 and $7,500. For agent work it inventories what you want agents to do, what they would need to touch, and what has to exist before that is safe — and ends with a prioritized plan and a real estimate. The plan is yours whoever builds it.
Tell us what you want agents to do.
Joseph reads every note and replies himself. If agents are the wrong tool for your problem, he’ll say that too.
Start a Project